[rmcdaniel]

The redrive successor evidence checker rejects a Core-shaped ActivityCancelled between a cancellation request and delivery, and rejects delivery to the next unscheduled call after the successor resolves its earlier calls. It now validates cancellation identity and resolution by history-row order, and derives the next durable sequence from typed steps recorded before delivery. Earlier activity, timer and signal calls must have a matching resolution before that next call is reachable.

The grouped/selection boundary remains explicit: parallel, selection_handle, span and operation operands are excluded and have negative controls. The change is limited to the evidence checker and its tests; the checked-in replay fixtures and production SDK source are unchanged.

The rules follow Core resolvedBeforeRequest, nextDurableCommandSequence, and the recorded activity cancellation identity. The extra resolved-earlier-call guard belongs to this single-call successor model and does not claim general grouped Core eligibility.

Validation:

• 578 focused replay-clock, successor-evidence and redrive tests pass.
• Ruff passes over src/ and tests/; mypy passes over all 42 production source files.
• All 29 new probes ran against the exact base checker at 3dee6c263d335b32d30d45f958b74fb585d21e56: 16 failed and 13 passed. All 29 pass with this change.
• A full sweep of 102 existing replay cases (92 regression fixtures and 10 golden-history cases) preserves every verdict and diagnostic: nine accepted, 93 refused. Existing non-qualifying evidence and registry hashes remain intact.
• Added-line credential/private-path review and git diff --check pass.

Fixes #244.

Hosted qualification is terminal success at exact 4abf7d042aa1c1ef2d36a588edad67507096da74: all 20 checks pass. Independent Security source-only PASS is recorded for that unchanged head. General retains the ready/merge decision.

[sonarqubecloud]

Quality Gate passed

Issues
7 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact-head hosted qualification is terminal success for 4abf7d042aa1c1ef2d36a588edad67507096da74 on base 3dee6c263d335b32d30d45f958b74fb585d21e56.

Normal CI 41824227628 passes all supported Python versions, regression-corpus policy, lint/types, packaging, connected integration, cleanup and target-branch qualification. All 20 reported exact-head checks are successful, with zero failed or pending. Security's independent source review reports no defect against Core 28893f97; its final public disposition is requested after this terminal run.

The source remains unchanged from the prepared checkpoint: 578 focused tests pass, all 29 new probes pass (16 fail/13 pass against the exact base checker), and all 102 existing replay verdicts and diagnostics are preserved. The Rust #179 and PHP #250 rule handoffs are already recorded. The branch is pushed, labeled and clean. General retains the ready/merge decision; no runtime, protocol, fixture, version or release change is included.

[rmcdaniel]

Security source-only evidence review — PASS

I independently reviewed exact head 4abf7d042aa1c1ef2d36a588edad67507096da74 (tree cfd2147f1b8dafdd48d0b9f0c5e156de8cb40963, base/parent 3dee6c263d335b32d30d45f958b74fb585d21e56). The draft PR is mergeable/CLEAN and changes only two test/evidence-model files (203 insertions / 6 deletions); production SDK and checked-in replay fixture bytes are unchanged.

The revised checker matches the cited Workflow Core 28893f97 boundaries for this deliberately single-call successor model:

• ActivityCancelled is a typed activity resolution with required positive sequence and nonblank activity type/execution identity. Resolution eligibility is decided by history-row order relative to the cancellation request, not wall-clock text alone.
• Delivery to an unscheduled next call uses one past the highest typed durable step recorded before delivery. Earlier activity, timer, or signal calls must have an identity-matched terminal event before that next call is accepted; open, foreign, after-delivery, or skipped-step histories are refused.
• A resolved earlier call and atomic memo step advance the durable sequence correctly. Timer and signal resolutions must match their opened identities.
• The evidence model does not claim grouped or selection eligibility: parallel, selection_handle, sequence spans, operation sequence, and operation spans remain explicitly refused.

All 29 new probes pass at this head; against the exact base checker, 16 expose the prior rejection/gap and 13 preserve accepted behavior. The recorded 578 focused tests, full Ruff, and mypy over 42 production modules passed, while all 102 pre-existing replay verdicts and diagnostics remain unchanged. Fresh hosted qualification is terminal at this exact head: all 20 checks succeeded, including Python 3.10–3.15, regression corpus, lint, package, connected integration, public-boundary checks, CodeQL, and Sonar.

Disposition: Security PASS for this exact source-only evidence change. This does not modify or qualify production replay behavior, protocol, a runtime experiment, package publication, or release. General retains merge and any later cross-SDK adoption decisions; Rust/PHP parity remains separately owned.

[rmcdaniel]

General merged exact 4abf7d042aa1c1ef2d36a588edad67507096da74 normally as dd43ce4f2b01901a78fc239f4927cfc9293bc90a after independent evidence-model review, all 20 exact-head successful checks and Security source PASS. Ordered parents, reviewed tree and actual main are verified. The two-file model now recognizes identity-matched ActivityCancelled resolution and the next durable call only after every earlier modeled call resolves; grouped/selection exclusions remain explicit. Production SDK and replay fixture bytes are unchanged.

The SDK owner retains normal exact-main tests/source readback and #244 closure after acceptance, preserving the 102 prior verdicts and the existing Rust179/PHP250 concrete-rule handoffs. No production protocol, package or release changed. #259 and #188 retain their distinct published-runtime/installed acceptance.

[rmcdaniel]

Independent post-merge acceptance passes for dd43ce4f2b01901a78fc239f4927cfc9293bc90a.

• Ordered parents are exactly prior main 3dee6c263d335b32d30d45f958b74fb585d21e56 and reviewed source 4abf7d042aa1c1ef2d36a588edad67507096da74. Merge tree cfd2147f1b8dafdd48d0b9f0c5e156de8cb40963 equals the Security-reviewed source tree.
• Exact-main CI 41829693322 is terminal success, including all supported Python versions, integration, cleanup and final qualification. All 18 reported checks on the merge commit pass, with zero failed or pending.
• Production SDK and checked-in replay fixture bytes are unchanged. The source qualification already verifies 578 focused tests, all 29 new probes, and preservation of all 102 prior replay verdicts/diagnostics, plus full Ruff/mypy and Security source PASS.
• The merged source branch is deleted and independently returns 404. The reviewed commit remains reachable through main.

The Rust #179 and PHP #250 owners have the concrete identity/order/reachability rules. Grouped/selection/span/operation shapes remain explicitly outside this single-call evidence model. No protocol, runtime experiment, package or release changed.

This completes #244's source acceptance; its automatic completed closure at merge is confirmed. #188 and #259 retain their distinct future published-runtime/installed acceptance gates.